A solution for enabling UDP in the web - <AUTHOR> http://new.gafferongames.com/post/why_cant_i_send_udp_packets_from_a_browser/ <comment><USER2> Minor nit that I almost hesitate to pick but I've been doing 100-series network training lately so this is something that I'd tell my students:

> UDP packets are not encrypted, so any data sent over these packets could be > sniffed and read by an attacker, or even modified in transmit. It would be a > massive step back for web security to create a new way for browsers to send > unencrypted packets.

TCP packets are not encrypted, either. That data is transmitted via UDP or TCP doesn't make it encrypted; encryption is handled elsewhere.

Now if you insist that the _contents_ of the transmitted UDP packets are encrypted--as the author does with the documented proposal--then that's one thing. But the data transport mechanism (UDP vs. TCP) doesn't inherently mean encryption.

(Fun fact I learned while writing words about TLS: Use of TLS does not automatically imply confidentiality--that is, encryption--of the data being transported. TLS supports a NULL cipher[0] that ensures integrity and authenticity but the payload is "in the clear.")

0 - [https://tools.ietf.org/html/rfc4785](https://tools.ietf.org/html/rfc4785)

<comment><USER3> You're not wrong, but I think the point was, in a browser, you can get your TCP _connection_ "automatically" encrypted by connecting to HTTPS endpoints. It's not so easy -- "built in" \-- with a connectionless protocol.

<comment><USER4> There is DTLS if you really want turnkey encryption for UDP, and it's implemented by openssl so it's straightforward enough to find an implementation. Not the most widely deployed protocol out there, to be sure, but if browsers wanted to make that the condition of use it would soon become widely implemented.

<comment><USER3> "openssl [...] straightforward" I don't think so. It's in the article; DTLS is too complex. The author wants something simple.

Most implementations (eg. WebRTC) involve pulling in truck loads of C libs; it's insane. And then you want to support other clients? Good luck.

</comment></comment></comment></comment><comment><USER5> It's kinda sad that TCP was chosen so long ago for HTTP that there's effectively no changing it. With modern TLS the underlying data guarantees TCP gives you just aren't that useful. We have kinda a weird situation where we have TCP->TLS->HTTP in layers when it could all be one protocol layer. We also wrap a stateless protocol (HTTP) inside a stateful (TCP) one which causes some insanity.

What the problem with doing it the current way? Massive routing inefficiency at scale. Since the layers for persistence and routing (L2-4) don't carry all the info needed to connect to a server (some like headers and URL are up in HTTP - L7) it's mandatory to "unwrap" through the protocol layers before you can determine where a stream/packet/HTTP req is supposed to go.

This means you can use something like IPVS as your L2-3 load balancer, but once the streams are divided out by IP/port you need to do the TLS+HTTP in one step. There's also some hard limits on how much traffic a single IVPS instance can handle because balancing TCP even at low level requires the router to keep track of connection state (conntrack). So we have this situation where there's a main low-level balancer with some arbitrary traffic limit imposed from TCP overhead, and behind that we have a bunch of child balancers doing way more work than they should be handling the connection from the TCP level through TLS and HTTP before they can pass on the connection to a back-end app server.

This could all be avoided if HTTP was a stateless UDP based protocol, and TLS was baked in rather than being an additional layer. It would make routing and load balancing far more effective at scale. You probably wouldn't see nearly as many DDoS attacks succeeding, because the vast majority of them exhaust CPU power far before they actually flood you off the net.

<comment><USER6> I think the question is not so much could http have used UDP, but rather is the browser the right place to build a complex piece of software. The fact that you can doesn't mean that you should. I am a bit concerned that the browser is becoming the only cross platform API and we are forced to build complex software on top of a scripting language that was only designed to fire up porn advertisement pop ups.

<comment><USER7> Ignoring the (in)validity of your characterization of JS, web assembly will remove this reliance on JS

</comment></comment></comment><comment><USER8> My memory is fuzzy, but I'm pretty sure I did this with WebRTC a while ago. Use RTCPeerConnection in unreliable mode, "peer" with the server, and you should have a UDP-backed SCTP connection. I'll try to dig up my PoCs on this.

Edit: Oh he mentions this, but invalidates it due to the complexity of typical P2P:

> But from a game developer point of view, all this complexity seems like dead > weight, when STUN, ICE and TURN are completely completely unnecessary to > communicate with dedicated servers, which have public IPs.

I don't remember this being complex (there was some off-the-shelf library for getting a data connection on the server-side), but YMMV.

<comment> TD-Linux That's because you don't need to implement any of those things for a basic client-server architecture. Unfortunately it looks like the author saw the massive and complex webrtc.org implementation and gave up, rather than try writing their own minimal implementation, or borrow from other implementations like Janus ([https://janus.conf.meetecho.com/textroomtest.html](https://janus.conf.meetecho.com/textroomtest.html)).

<comment><USER8> Yes; vaguely... there was some (string) message format that you could manually stitch together with the right IP and port, etc, and basically tell the browser's WebRTC implementation "other client is on this IP and port". I seem to have deleted this code unfortunately, the only thing I saved is this link:

[https://github.com/cjb/serverless-webrtc/](https://github.com/cjb/serverless- webrtc/)

EDIT:

Aha! I based my code on: [https://github.com/js-platform/node- webrtc/blob/develop/exam...](https://github.com/js-platform/node- webrtc/blob/develop/examples/bridge.js)

<comment> TD-Linux Yup, the format is called SDP. It's an old, crufty, and mostly effective way to specify not only the port and IP, but also whether a TCP fallback is being used, video and audio formats, and other things you can mostly ignore when just using data channels. See the "answer" section of 5.2.3 of [1], for details of some of the other magic numbers (which your JS library should handle for you). You can also check out about:webrtc to see SDPs made by other websites, like the Janus demo page.

[1] [https://tools.ietf.org/html/draft-ietf-rtcweb- sdp-03](https://tools.ietf.org/html/draft-ietf-rtcweb-sdp-03)

</comment></comment></comment></comment><comment><USER9> > Websites would be able to launch DDoS attacks by coordinating UDP packet > floods from browsers.

> New security holes would be created as JavaScript running in web pages could > craft malicious UDP packets to probe the internals of corporate networks and > report back over HTTPS.

Is this the same reason that the "raw" TCP is not supported on the web? When I first learned WebSocket I was surprised that it is a message-based protocol. What I imagined was a protocol that utilizes HTTP only as a means of negotiation, and the actual transfer is done just as the raw TCP does. But it's not, so I had to create another layer to be interoperable with the existing (raw) TCP server. What was the exact reason?

Edit: Another reason I can think of is the encoding issue, cause TCP is byte- based. But the current WebSocket spec already assumes UTF-8 for textual data, and is also capable of sending bytes using `ArrayBuffer`. I don't see how this would matter in practice.

<comment><USER10> Just a remark: You can use the websocket spec to emulate TCP behavior, which means get a stream instead of messages: Send only one giant message (payload set the maximum) and use Continuation frames to stream new chunks of data to the other side. FIN will be only set once the stream has finished.

The downside: A lot of websocket APIs (and most especially the one in the browser) don't support this and will only send/receive complete messages. Which means if you want streaming support you better implement it as a layer on top of messages, since it works everywhere.

It's a little bit sad that the websocket spec is complicated through the continuation frame feature while in reality noone has a reason to use it.

And back to the question: The masking "feature" of websockets is also there to prevent browsers from speaking raw TCP. Without it Javascript could craft exact TCP payloads, which might in certain situations be used to directly talk and manipulate internal services. The masking guarantees that the remote on the TCP connection will get some random data after the websocket header.

<comment><USER9> That's interesting, I've always thought the WebSocket spec is too complicated with all those frame types and message fragmentation, and I completely ignored contunation frames when I had to implement the protocol myself. But it seems more versatile than I imagined. Though the workaround you mentioned sounds a bit hacky.

And yeah, I now remember that masking was also a problem at the time. So even if web browsers adopt a new API to send fragmented messages, it would still not be possible to directly plug in them to legacy servers. Sad.

Edit: It would also be possible to send a single giant message, which contains a single giant continuation frame sent for the lifetime of the session, which is followed by a FIN frame. Am I correct?

<comment><USER10> Yes, you could use the single giant message too. The drawback to the continuation frame approach is that you can't interleave it with ping frames (for connectivity checks) and that you won't be able to signal end of stream (FIN). If that's not required because your higher level protocol takes care of that things otherwise it would be fine.

</comment></comment></comment></comment><comment><USER11> I am using WebRTC with a MMO server cluster written in Golang. Basically, I got Simple-Peer WebRTC library to run on top of node-electron in NodeJS. My Golang coordinating server then also coordinates a farm of 4 NodeJS processes which basically run as UDP proxies. The complexity of WebRTC is tamed by Simple-Peer.

One downside: Getting node-electron to run takes some wading through shared library installs to satisfy Chrome dependencies. However, this turns out to be a series of straightforward responses to error messages. Another downside: I'm wasting some memory and swap on Chrome dependencies I'm not using. In the case of my game, I'm always going to be more CPU/bandwidth bound than memory bound, so this turns out to be a non-issue. A third downside: WebRTC uses up 72 bytes of each packet with its own header information.

All that said, it appears to be running like a champ. It also makes a big difference in the play-ability of my game in poor network conditions.

<comment><USER12> Are you using the data channel p2p or client-to-server?

(I work on WebRTC and implemented much of the data channel; I'm always interested when someone uses it)

<comment><USER11> Client server. I'm being extra paranoid about cheating/security, so it's a naive client-server, authoritative server architecture. The client isn't much more than a dumb server, but for 2D sprites, not text.

</comment></comment></comment><comment><USER13> I think some of the ensuing discussion here says clearly why UDP in the browser (at least as in giving developers access to firing off random UDP packets from a browser) is a bad idea: people don't understand network protocols, yet they feel they have something to contribute to the discussion.

</comment><comment><USER14> I'd like to focus on the security issue of 'UDP probes and sending results back over HTTPS'. This is an /inherent security issue/ of running ANYONE else's code within a corporate network.

ECMAscript/JavaScript should NOT be blindly run within corporate networks, and web 2.0 is insane for making all websites expect that.

<comment><USER15> Can you elaborate on this? Legitimately curious.

<comment><USER16> Parasitic Companies want the ability to run anything they want, on anyone's machine, accessing all of the users personal data, as well as their competitors data if they can get at it, and use it for whatever reason they want, and have the ability to secure those revenue streams by erecting wholly artificial and socially destructive barriers to their removal, such as getting accepted to represent their interests in standards bodies then twisting the standards to do what they want. An example of this is EUI addresses in IPV6 with the Mac address as part of the IP address as a revenue stream maximization method for advertisers.

There was a you tube video awhile ago showing java-script able to run an operating system in a web browser as well as games inside the OS. Recently, Chrome added a task manager and user logins. Chrome is no longer a web browser, it's an operating system, and what enables an entire ecosystem of abuse is java-script.

In a few years hence, someone will figure out a technology that will disable java-script from running on client machines via firewall filter. It will break a lot of websites. Let it.

<comment><USER17> Each tab runs in its own thread, a page consumes CPU and RAM. I'm not sure why it's a bad thing that a web browser has a task manager. Especially since one of the powerful things about the web is that no extra software is required for debugging / development.

It's totally possible today to create a filter that will scan for JS and remove it from sites with one of those man-in-the-middle corporate proxies.

But it'll break pretty much every site. If you're talking about a company, that's as conductive to security as mandating weekly password changes requiring no repetition, symbols, lower + upper case and 15 characters.

Users will find ways around it. Like bringing unmanaged devices to browse the internet.

In terms of broken websites, corporate users don't have the influence as they did in years past.

Since we're trending towards pretty much every person in more economically developed countries having smart phones.

If a website doesn't work for a business's users I don't see how site owners will care.

On the development of web browsers becoming an OS of their own. Sure there's work to be done to improve security. For example, fingerprinting needs to be properly mitigated [1].

The web is open. Anyone can implement a web browser. Chrome, Safari, Firefox, Edge are trending towards writing one webpage/app and having it run everywhere.

Windows, OSX, Linux, Intel, ARM, Desktop/Laptop, Mobile/Tablet. Aren't a concern past display/formatting.

[1] [https://panopticlick.eff.org/](https://panopticlick.eff.org/)

</comment></comment></comment></comment><comment><USER18> > It falls down because WebRTC is extremely complex. This complexity is > understandable, being designed primarily to support peer-to-peer > communication between browsers, WebRTC needs STUN, ICE and TURN support for > NAT traversal and packet forwarding in the worst case.

You don't need WebRTC's level of complexity to do P2P. WebRTC is an over- engineered Rube Goldberg machine for many reasons, including the fact that it tries to include so many capabilities in a single standard. It's also complex because STUN, TURN, and ICE are overly complex. WebRTC should have used a simpler underlying design. You really, really don't need all that. I say this as a developer of multiple P2P protocols including some that are used in serious applications.

Then there's stuff like: [https://github.com/js-platform/node- webrtc](https://github.com/js-platform/node-webrtc) \-- you don't have to do your whole backend in Node if you don't want, but you could plug something like this in _on your servers_ and speak WebRTC to clients. In P2P a server is just another node and there is nothing the says servers can't talk in P2P networks.

I do believe it would be nice to have UDP in browsers somehow. In fact I think it would have been far better to just add UDP to the browser spec and leave WebRTC out completely. It could have been implemented in JS (and WASM in the future) using TCP and UDP transport provided by the browser. Doing it the way it's been done is like including application software in a computer's ROM. It's the wrong place to put that level of abstraction.

</comment><comment><USER19> I believe the security model in browsers is fundamentally wrong. I understand why it evolved the way it did, but it is far from optimal.

In particular, I mean that subrequests are sent by default _with credentials_ (cookies). This is backwards. In an ideal world, I should be able to send arbitrary anonymous HTTP requests, and should have to jump through hoops to send along the user's cookies. In reality, it is the other way around. This is the original sin that makes CSRF possible. Any site can send a request to any other site I am logged into, and pretend to be me. I understand that we can't change that now, but it just seems wrong.

Right now, you _can_ send anonymous requests (e.g. using windows.fetch), but unless a specific CORS header is returned, you cannot access the results! Ideally, it would be the other way around, and you could only send authenticated requests if the target site cooperates.

Now you can make as many requests as you want (e.g. by using img or iframe tags), but if you want to use the results, you need 1. the site's cooperation, or 2. you need to include remote javascript. This is the next backwards thing. Why do I have to execute remote javascript when I just want JSON data? This should be absolutely discouraged in an ideal world!

The current security model precludes a lot of things. One is the classical Mashup. Back then, when Web2.0 was hot, I made a simple HTML page that scraped another website for geodata and wanted to display it on a Google Maps map. Imagine my shock when I found that I cannot read another (open, non- credentialed) web page with XMLHttpRequest.

There are a bunch of applications that I just cannot write within the current security model, and I believe it is in the interest of certain people to stay this way, so that they can remain in control of content.

The same applies even more when I think of allowing UDP or general network access. Imagine an IMAP client or BitTorrent client in the browser. A pirate iTunes that doesn't rely on a central server. A Tor implementation. You could even do JS crypto somewhat securely - you wouldn't serve the .html page over HTTP, just a simple static file that you'd deliver like any other program.

Sometimes I dream of a HTML 6+ "application profile" that would be opt-in, and allow you to do these kind of things.

</comment><comment><USER20> I think the title of the blog post is misleading.

What he really wants is a connection-oriented, TCP-like protocol with more flexible handling of missing/delayed packets. (As this is a frequent use-case in game development).

His solution is a UDP-based protocol that satisfies this and other use-cases specific to networked games while keeping the connection semantics of TCP.

However the fact that it's UDP-based seems like an implementation detail to me. The proposed solution hides a lot of other UDP-features that are not contributing to those use-cases but would absolutely make sense in other situations (like connectionless messages and broadcasts)

<comment><USER21> > What he really wants is a connection-oriented, TCP-like protocol with more > flexible handling of missing/delayed packets. (As this is a frequent use- > case in game development).

What I really want is the most UDP-like thing possible in the browser, that lets people build whatever higher level protocol they want on top of it, just like game developers do on every other platform.

Being connection based is important because if it wasn't then it would quickly turn into a DDoS tool, or a security nightmare for probing internal networks for vulnerabilities.

So clearly it needs to be connection based. And if it needs to be connection based, then that rules out broadcast packets too.

<comment> irq-1 Would a clear-text token, in addition to an encrypted connect token, allow servers to drop packets faster (since it wouldn't require decryption)? A clear token could be changed (cached, expired) however the back-end wanted, which would include dropping all new connection attempts when under DDOS.

I didn't see a port number anywhere. Shouldn't you define 443/UDP (or other) as the only connection port? This would allow networks to manage the traffic, for example dropping all UDP/443 traffic internally, or managing bandwidth at a firewall.

Finally, shouldn't P2P be in the mix? If not now, won't we be doing this again in a few years?

Thanks for taking on such a big challenge, and for listening to the peanut gallery.

<comment><USER21> I actually do stuff like this, in the connection request packet a mix of "additional data" protected by the AEAD as well as encrypted data (keys), allows me to quickly reject stale tokens because the expire timestamp is public, but protected with signature check, vs. having to fully decrypt first to see the token is stale.

I don't have any defined port because in the game industry we tend to run multiple game servers on the same box, so we take up a bunch of ports. I acknowledge that this could cause issues with corporate firewalls, and would be open to ideas how to solve this.

Regarding P2P, I think WebRTC solves the problem of browser to browser communication just fine. Any attempt to support p2p this would just end up rewriting WebRTC.

What I'm trying to do is solve just one small part of the problem, in a WebSockets like way, just one thing that would enable a lot of other cool things to be built on it, if it were adopted by browsers.

cheers

<comment> irq-1 > quickly reject stale tokens because the expire timestamp is public, but > protected with signature check

A forged timestamp would still need a signature check, but a clear-text token would not. The speed difference would only be important with a flood of forged packets, each of which would need to have it's signature checked. Additionally, each system could implement a different type of defense: like issuing regional clear-text tokens, or A/B tokens to find which account is leaking a clear-text token, or giving each server it's own token so a DDOS attempt that wanted to force signature checks would need to get the right token (and get it again when an attacked system changes it.) Hosting providers that offer DDOS protection today could offer integrations based on clear-text tokens that wouldn't need any interaction from a game system (other than submitting the clear-text tokens.) I don't know if routers typically have the ability to check a signature, but they can probably drop packets that don't pass a (clear-text token) mask check.

The port issue is interesting. Maybe a range of ports (44300-45100) would work for network administrators. Maybe there should be restrictions and a listing of uses like the first 1024 (this is voice, that port's video, file transfer, etc...)

Browsers should also limit connections. Only 2 connections/IPs at a time? Only JavaScript from the origin domain (the address in the URL) can open connections, not advertisements or iframes. Maybe ask the user to open connections like browsers ask to use your location or audio/video.

I wonder too if a browser should only open a connection when presented with a request signed using the (private) domain SSL cert? That would drastically reduce the ability of bad JavaScript to co-opt browsers of a website (into a DDOS of connection requests.) To use a websites traffic for a DDOS, you would need the SSL keys. Browsers could also be required to add the domain and verified domain sig to a connection request, so a website that cause a DDOS would be identified. I'm not sure identifying the website would lead to accountability since they may have been compromised, but it would prove which domain caused a browser based DDOS; reddit.com couldn't claim a bad advertisement caused their millions of browsers to open connections. This wouldn't stop forged packets, but it should stop innocent web-browsers from becoming a tool for DDOS.

</comment></comment></comment></comment></comment><comment><USER22> > Additionally, the server enforces that only one client with a given IP > address may be connected at any time

So much for people behind carrier NATs

<comment><USER21> My bad: I meant IP address + port. Fixed in the article.

<comment><USER23> Well what good is that? You can't tell if multiple IP,port pairs are from a single client or multiple clients.

<comment><USER24> The nat device will have different source ports for two connected clients.

<comment><USER23> It would also have different source ports if the client is using random source ports as well. So two client connections from the same host behind NAT would look exactly the same as two client connections from two different hosts behind NAT.

<comment><USER21> Hence the authentication on the web backend and the unique 64bit client id.

</comment></comment></comment></comment></comment></comment><comment><USER25> The use of libsodium looks absolutely brilliant. Would the author recommend using netcode.io for general games, not just agar.io or browser style stuff?

<comment> hach-que I'm an external contributor who did the C# bindings for netcode.io available here: [https://github.com/RedpointGames/netcode.io](https://github.com/RedpointGames/netcode.io)

As someone who wrote her own (non-encrypted) networking protocol for desktop games, netcode.io certainly seems easier (especially with the built-in security), so in the near future I intend to move my projects over to using netcode.io instead of what I have currently.

</comment></comment><comment><USER26> Answer: a browser _was_ for traversing hypertext documents. UDP basically is not good for this.

Now a browser is just an abstracted operating system. So, fuck it, I guess, let's add a second TCP/IP stack.

<comment><USER27> The browser is a much better multi-user operating system than the actual operating systems people tend to use. A video game on the average Windows, Mac, or Linux desktop has full read and write access to the memory of a tax app on the same desktop, defeating the entire point of memory protection. If the game and the tax app are in a browser (or in a mobile OS, to their credit), this isn't so.

That desktop OSes happen to be called "desktop OSes" and web browsers happen to be called "web browsers" is fairly irrelevant to what they're actually good at. Desktop OSes make great hardware abstraction layers, just as server OSes make great hardware abstraction layers for virtualization platforms. But they're fundamentally misdesigned for much of anything else.

<comment><USER28> Desktop operating systems have the capacity to do this; "server operating systems" (which are just desktop operating systems configured differently) already do this.

You run each program as a different user account. The HTTP daemon doesn't run as the same user as the DNS daemon even if they're on the same machine.

This is obviously _annoying_ on a desktop because you have to use user switching to use another app. It would be better if desktop operating systems provided native support for it so that user accounts had a sub-account per app and apps automatically ran like that, and then a permission prompt if one app tries to access another app's files, which you can grant as one-time access or permanently.

Then you expect your email program to try to access a document you're attaching to an email, but if a video game tries to read your tax returns you can be appropriately suspicious.

<comment><USER27> Correct. This is a design problem, caused by building ill-suited interfaces. (This isn't a criticism of the people who designed the interfaces; we simply didn't have the depth of experience when UNIX and Win32 and their predecessors were designed, and now we're stuck with compatibility for those.)

The interface between a web page and the outside world allows it to do things like access its site and not others, request a particular file be opened, send structured messages to other sites that wish to opt in to such access, etc.

The interface between a process and the outside world gives it either TCP sockets on behalf of the machine, or nothing at all; either the ability to open any file as the current user, or nothing at all.

I used to be excited about proposals for desktop operating systems to provide sandboxing via multiple UIDs and native interfaces for passing files around and powerboxes and all of that good stuff. Then I realized that the web platform does all of that and is very widely adopted and well-tested, and there's no hope of the existing platforms catching up.

I used to have two user accounts, one of which was allowed to run the Flash plugin so I could listen to music, and one of which held my important work. Then the web folks figured out how to sandbox the Flash plugin without requiring me to Ctrl-Alt-F8 to pause a song. Then they figured out how to not use a native-code plugin at all.

I don't particularly _like_ this conclusion in an abstract sense, but it's certainly let me get on with getting things done instead of hoping for a future that will never come.

</comment></comment></comment></comment><comment><USER29> > Why can't I send UDP packets from a browser?

You can, if the browser is Chrome: [https://developer.chrome.com/apps/sockets_udp](https://developer.chrome.com/apps/sockets_udp)

<comment><USER30> Worth noting this is using the "chrome.etc" object, which is only available to apps and/or extensions.

<comment><USER31> Which, at this point, just means extensions: [https://blog.chromium.org/2016/08/from-chrome-apps-to- web.ht...](https://blog.chromium.org/2016/08/from-chrome-apps-to-web.html)

<comment><USER30> There are still critical holes in the extension API that they haven't plugged, e.g. filesystem access (super duper important if you want to make an app that can edit / create images, for instance, and not want to shove everything into the downloads folder or force a chooser every time). I'm not sure how they're going to shut things down while crippling the ecosystem so severely (though to be fair, Firefox is doing a similar crippling-move (but for solid reasons, IMO)).

</comment></comment></comment></comment><comment><USER32> Obviously going out of his way to implement in a secure way as a software practitioner. I would love to see a review of the design and implementation from the standpoint of a security expert.

</comment><comment><USER22> Interesting idea I had: why not have _many_ QUIC streams?

<comment><USER33> Are you thinking one stream per packet?

<comment><USER34> You could have a pool of them, right? Or would you have to actually tear it down after each packet

</comment></comment></comment><comment><USER35> Minecraft works great over TCP[1], so casual clickers like agar.io mentioned there, and most games except fast-paced shooters will work too.

[1] [http://wiki.vg/Protocol](http://wiki.vg/Protocol)

<comment><USER36> Minecraft "works" over TCP but I wouldn't call it great. TCP works great for things like block data since keeping those ordered makes it easy to send changes instead of resending whole chunks. On the other hand, entity movement being TCP is a real pain due to the head of line blocking which is one of the reasons PvP can be a pain and why it can be impossible to melee mobs without them hitting you first.

</comment></comment><comment><USER37> Some things I noticed about the proposed protocol:

\- It's not clear how data is encrypted. I don't see a client key being generated. It will be very difficult to do this right without using something like TLS. Are the keys just sent over an unencrypted channel?

\- The connect token should contain the client's IP address, so the server can verify the same IP that got the token is trying to connect. This prevents someone from using a valid token for reflection attacks.

<comment><USER38> Presumably the keys are sent over HTTPS.

<comment><USER21> Yes, the connect token is transmitted from web backend to client over HTTPS.

This token contains public and private data. The public data tells the client which servers to connect to, what the keys are etc, hence the need for HTTPS.

The private data is what gets sent over UDP in connection handshake, and is encrypted with a libsodium AEAD primitive using a private key shared between the backend matchmaker and the dedicated server instances.

Because of this clients cannot read, modify or forge the connect token private data, so cannot connect unless they get a token from the backend.

Tokens are only valid for a specific authenticated client to connect to a small set of n dedicated servers, and expire quickly (30-45 seconds).

</comment></comment></comment><comment><USER39> Do the authentication over TCP and then fallback to UDP for rest of the communication? For encryption, have you considered DTLS? Read more in `Hybrid Implementation` section of [http://ithare.com/udp-for-games-security- encryption-and-ddos...](http://ithare.com/udp-for-games-security-encryption- and-ddos-protection/)

</comment><comment><USER40> The article misses one important reason why allowing UDP from the browser is a bad idea:

UDP provides no congestion control. Given the (lack of) quality of what gets developed for the browser, allowing it to send raw UDP would most likely cause an extraordinary amount of problems for the Internet as a whole.

<comment><USER21> Games have been spamming UDP packets over the Internet for the last 20 years and the Internet seems to be doing OK.

</comment></comment><comment><USER41> Why enforce server limits? I'm building a multiplayer game where user actions can happen at most every 150 ms. Am I naive thinking that one server should be able to handle thousands of simultaneous users? I understand the limits when it comes to fast-paced games though.

<comment><USER42> It depends. MMO's can generally handle thousands of users per second, but realistically those generate only one event per second. There's faster-paced games like Planetside and Battlefield which allow for hundreds of users per server though.

<comment><USER41> Thanks!

> but realistically those generate only one event per second

How does that work with seeing other avatars walking around in real-time in for example WoW? Are their trajectory only updated once a second? In my game it's not really displayed in that way but I'm curious.

<comment><USER43> Player position is not very critical in WoW or similar games. Combat is mostly selecting an enemy and attacking it. Or selecting enemy and casting a ranged spell. The game is designed with this server lag in the mind.

Servers can easily sync player positions once per second and the clients would happily interpolate between prev & current positions. You are probably seeing things a little late/different than server but it does not matter.

</comment></comment></comment></comment><comment><USER44> can't understand this bashing of WebRTC, it is good technology, TURN config is optional is not compulsory, but believe STUN is still necessary because, unlike the public server, the client is behind NAT, but then again, setting up a TURN+STUN server is a trivial job...

<comment><USER45> Why would STUN be necessary if the client is behind NAT? So long as the server is not, the client can send the first packet and NATs will establish associations for the packets from the server to arrive to the client.

</comment></comment><comment><USER46> Why can't I DDoS an arbitrary host using nothing but twitter accounts?

</comment><comment><USER47> Also includes alternative protocol implementation design and source for protocol.

Would love a simple way to do client<->server udp from browser!

</comment><comment><USER48> on mobile devices or accessing internet through mobile network, i would wager that it is congestion control which causes more heartburn than head-of-line- blocking.

this is predicated on the fact that packet loss e.g. due to poor signal etc. is conflated with congestion in the network. this then results in tcp reverting to slow-start etc etc

</comment><comment><USER49> You could always use something like Electron if you can get users to download your app, which would allow you to use whatever node native networking libraries there are, I'm sure you could send UDP packets or anything else, and still use web technologies and the browser to develop your app/game.

<comment><USER49> Why was this down voted? lol its a legitimate solution..

</comment></comment><comment><USER50> > Why can't I send UDP packets from a browser?

My tweet from May 2015 is titled "I've sent my first UDP packet from a browser!" [1]

[1] [https://twitter.com/shurcooL/status/605218976969261056](https://twitter.com/shurcooL/status/605218976969261056)

<comment><USER51> Looks like Firefox? Did you write a browser extension?

<comment><USER52> It's from Firefox OS: [https://developer.mozilla.org/en- US/docs/Mozilla/B2G_OS/API/...](https://developer.mozilla.org/en- US/docs/Mozilla/B2G_OS/API/UDPSocket)

<comment><USER50> No, it was an experimental implementation of [https://www.w3.org/TR/tcp-udp- sockets/](https://www.w3.org/TR/tcp-udp-sockets/) actually. Regular Firefox browser, not Firefox OS.

</comment></comment></comment></comment><comment><USER53> I'm not really sympathetic to the arguments against WebRTC. Ideally someone makes an open source library or 12, problem solved.

In fact looking at other comments here it sounds like it's not hard at all.

One other problem with WebRTC at the moment though, it's not supported by Safari

<comment><USER54> WebRTC will be enabled in Safari production builds shortly [https://bugs.webkit.org/show_bug.cgi?id=168858](https://bugs.webkit.org/show_bug.cgi?id=168858)

</comment></comment><comment><USER55> Could the "connect" token just be a JWT token?

</comment><comment><USER56> Network congestion.

</comment><comment><USER57> Cool, another protocol which claims for security and a reference implementation in... C

</comment><comment><USER58> Because there's no such thing as UDP "packets"?

</comment><comment><USER59> So let me get this straight... Basically this guy is trying to champion one of two things:

\- Yet another attempt to emulate a full OS-level network stack on top of HTTP (which already runs on top of TCP/IP).

\- Giving random web-pages access to RAW OS-level networking, and not just sockets, from untrusted internet JS.

How incredibly ass backwards am I if I find both proposals preposterous and dangerous?

> One solution would be for Google to make it significantly easier for game > developers to integrate WebRTC data channel support in their dedicated > servers.

I'm confused. Since when did Google decide what was web-standards? Is he deliberately mistaking Google for being W3C?

<comment><USER60> I don't think you got it straight.

> Yet another attempt to emulate a full OS-level network stack on top of HTTP

The proposed protocol does not work "on top of" HTTP. From the article:

> The basic idea is that the web backend performs authentication and when a > client wants to play, it makes a REST call to obtain a connect token which > is passed to the dedicated server as part of the connection handshake over > UDP.

So both the handshake and the actual data transfer happen directly over UDP.

Next:

> Giving random web-pages access to RAW OS-level networking, and not just > sockets, from untrusted internet JS.

The "Why not just let people send UDP?" section in the article actually explains why that would _not_ be a good idea.

</comment></comment><comment><USER61> I kinda disagree with the premise about UDP:

> It would greatly improve the networking of these games.

This is not accurate, i know it's like a rule of thumb that UDP is faster than TCP, but that's naive, there are cases where UDP will end up being slower, and to be honest, it depends on lots of variables, and at many times, the congestion control, packet ordering and all the bells and whistles that comes with TCP is well worth the little performance penalty, assuming that in that specific case it actually is slower than UDP

And of course if I'm wrong, someone will let me know :D

<comment><USER62> What people usually want is all the bells and whistles of TCP without the occasional huge latency spike introduced by the guaranteed ordered packet delivery to the application layer.

Unfortunately, all the alternatives (SCTP etc etc) seem to have foundered, probably due to aggressive filtering by border routers/firewalls making it impossible for alternative protocols to gain traction.

<comment><USER61> Exactly my point about the whole "many variables involved", many networks still filter UDP as you say, which is really bad if you want to make sure everyone can use your game</comment></comment></comment>


AMD's 8-core cpu for desktops arrives - <AUTHOR> http://www.xbitlabs.com/articles/cpu/display/amd-fx-8150.html <comment><USER2> XBit did a good calling out what AMD is doing here that is different (and in its infancy, disappointing with traditional benchmarks).

AMD has decided to step back from the brink of maximum-speed per core, to maximum-cores-per-chip.

If you look at the Anand benchmarks: [http://www.anandtech.com/show/4955/the- bulldozer-review-amd-...](http://www.anandtech.com/show/4955/the-bulldozer- review-amd-fx8150-tested/7)

you'll see in very multi-threaded applications (like compression or encoding) the AMD CPU actually keeps pace with the 2600k; in other applications where it is more important to have faster single threads of execution, the Intel 2600k pulls ahead by a drastic amount though.

These are the early days, but if AMD gets this down to 22nm next year and puts 16 cores on a desktop PC -- each core may be only running at 4Ghz, but in a scientific computing or server environment where you have 16, 4Ghz cores as opposed to 4, 6Ghz cores on some equivalent Intel can make a big difference.

The new Bulldozer platform looks to be a strategic company gamble on all fronts (more cores, less speed per core) that could win AMD big in the server space (which is exploding) and in scientific computing environments.

I'm not saying the numbers aren't disappointing, I was hoping to see some big ones in there to. I'm only pointing out that this isn't quite apples to apples, and when it is (e.g. straight multithreaded benchmarking) the comparisons look OK.

All that said, I'm sure Intel has something waiting in the wings (e.g. 2800k) to shit all over this party and beyond that we have tri-gate IvyBridge CPUs next year that will hopefully bring a much-needed* leap to CPU performance.

* "needed" as defined by "my impatient ass likes fast things.

<comment><USER3> _in very multi-threaded applications (like compression or encoding) the AMD CPU actually keeps pace with the 2600k_

What is the difference in price between these CPUs?

<comment><USER4> The 2600k is about $75 more expensive. The 2500k, which is closer to the FX8150 most of the time, is about $25 cheaper.

</comment></comment></comment><comment><AUTHOR> It's kinda sad to see AMD slipping behind even with their best effort. I was a huge fan for years and this i3 I am using now is my first Intel cpu since the 80386.

I was thinking maybe it's just that the OS and software is not parallel enough yet but the benchmarks show that's not the only issue.

<comment><USER5> Could you elaborate a bit more as to why AMD is slipping?

<comment><USER6> It looks like Bulldozer is a "speed racer" design that was intended to run at 4-5 GHz. It's hard to tell the cause from the outside, but either due to 32 nm fab problems or design problems they're shipping it at 3.6 GHz. Given the fates of NetBurst and POWER6, I cannot imagine why AMD chose such a design.

Another way to look at it is that the market will bear ~$1,000 pricing for Intel's flagship processors but <$300 for AMD's. That's sad. (I remember paying $700 for the first Athlon FX.)

<comment><USER4> I've heard that the main problem is that they don't really have the expertise and manpower anymore to do a full custom design, but are using a more ASIC style process - influenced by the ATI folks. Also, this is an all-new architecture and so you'd expect that it would be unpolished and untuned. Intel hasn't done anything as drastic as what AMD has done here since the introduction of the Pentium Pro. Well, there was the Atom but Bobcat (also an all new design) is able to beat that the same way that Intel is beating AMD at the high end.

In theory, this will let AMD mix and match components easily, and quickly synthesize new designs with the right mix of Bulldozer cores, Bobcat cores, GPU cores, memeory controllers, etc to meet market demand. I haven't seen any evidence that this is actually happening, though, or that its worth the price. By contrast, Intel has huge design teams that can afford to hand tune a range of designs to changing circumstances.

Its also true that though GF has a more tolerant set of design rules in its 32nm process, it pays for it in lower overall performance compared to Intel's process at the same node.

I'm not sure the high frequency design was a kiss of death. In terms of pipelining it doesn't seem any more aggressive than the Power7, which has been very successful. The Power7 benefits from 4-way SMT, though, and that probably helps hide the cache latency that is hurting Bulldozer so much.

EDIT: See example here: [http://realworldtech.com/forums/index.cfm?action=detail&...](http://realworldtech.com/forums/index.cfm?action=detail&id=123141&threadid=123055&roomid=2)

</comment></comment></comment></comment><comment><USER7> Am I the only one that would prefer cooler, quieter CPUs rather than 8-way monstrosities with big fans and creating lots of heat?

I have 2 systems running in my room, a 2-core desktop, and a 2 CPU quad-core system that I run virtualization on. This system replaced about 4 other towers that I had running, each doing various things like running web server, dns, etc, but basically just sitting idle and sucking up electricity.

I want to upgrade to a newer desktop, but I really don't want this thing to generate more heat, use more electricity and have a loud fan. Before, I wanted to upgrade my video card but couldn't find a reasonable graphics card that didn't have a fan.

<comment><USER8> Hmm, maybe instead of 2 system you can now have one 8 core system that runs virtualization and your desktop? Now you have one power supply, less fans, ...

There is nothing inherently loud or power consuming about 8-way monstrosities. Do you remember Pentium IV or even Alpha (One of those things could heat up a room plenty well in the winter).

<comment><USER9> Unfortunately, you can't hide the loud, hot running monstrosity that you use for the heavy work under a staircase in the basement if you use it as a desktop.

</comment></comment></comment><comment><USER10> The benchmarks are pretty disappointing.

</comment><comment><USER11> "The great revolution that AMD has been talking about... an eight-core desktop processor", is it really a revolution? an 8-core smartphone would be next..

<comment><USER12> Let's be more precise about what they've done. It's a processor designed for high single-core performance -- much higher than smartphone processors -- with good power-efficiency, on a much smaller die than would ordinarily be required for that.

And 8-core smartphone processor is very different from an 8-core desktop/server processor, and much simpler.

<comment><USER13> Are you saying bulldozer is "designed for high single-core performance"? Because that's exactly where it's failing to deliver, and what will continue to lead to market share.

<comment><USER12> It delivers very high single-core performance compared to smartphone processors, which was the subject under discussion. How it stacks up against other desktop/server processors is important within that market, but a distinguishing feature of desktop and server processors is that they _all_ have high single-core performance.

</comment></comment></comment></comment><comment><USER14> Has anybody seen any benchmarks of this CPU in Linux?

I'm wondering how it would fare in a build server...

<comment><USER15> How many build servers are actually constrained by CPU and not IO?

If your build times are in excess of a few minutes it's probably better to distribute the build across many machines rather than trying to build one server to rule them all.

As for benchmarks there are extensive reviews online of the bulldozer branded as "Opteron".

[http://www.phoronix.com/scan.php?page=article&item=amd_b...](http://www.phoronix.com/scan.php?page=article&item=amd_bulldozer_linux&num=2)

<comment><USER16> In my experience (game development, hundreds of thousands of LOCs of C++), compiling is purely CPU limited if your HDD isn't utterly braindead (e.g. at or above normal desktop 7200 rpm levels).</comment></comment></comment>


Questions to Ask During a Ruby Interview - <AUTHOR> http://blog.ritirisi.com/2008/06/17/15-questions-to-ask-during-a-ruby-interview/#more-3 <comment><USER2> I think a good question to think about is why someone would want to design an interview to specifically hire Ruby on Rails programmers. Other than a few very rare situations when you want an expert fast, what would a rails programmer offer that a C++ and Lisp programmer with a solid grasp of data structures and algorithms wouldn't? Even in the few cases when specialization is important, I still wouldn't design an interview entirely around Ruby on Rails. Every framework has some gotchas that you only learn with experience, but beyond that there is a ton of other stuff a good programmer should know that's outside the realm of any given framework, or even any given language.

I've seen programmers that were hired specifically for C++ positions struggle to move to J2EE projects, and it wasn't pretty. It's usually not a good idea to hire one trick ponies.

<comment><USER3> These interview questions were about Ruby, not Rails.

If you are hiring for a position where the developer will work primarily with Ruby, it makes sense to ask Ruby-specific questions or have a Ruby coding exercise. That shouldn't be the whole interview of course; as you mention, an all-around strong candidate is preferable.

That said, the questions in the article don't require much Ruby experience. Anyone with a grasp of OOP concepts could probably get most of them right.

<comment><USER4> Coffeemug beat me to my comment about this post. We're an all Ruby shop, and I don't think we've ever hired someone who (a) knew Ruby well coming in and (b) wasn't up to speed in under a week. If you're strong with Python, Perl, or Lisp, you will do fine in Ruby.

It is not a buyer's market for Ruby devs. Any post that suggests you screen a candidate based on whether they know what the "||=" operator does is offering bad advice.

<comment><USER5> Yes but if you are looking to hire people who already know Ruby, they should know at least those basic questions.

<comment><USER6> The precise semantics of ||= were subject to a longer discussion on ruby-talk. I don't think it's really that important whether it expands to 1.) a || a = b or 2.) a = a || b, is it? So all you would know about a person giving answer 1) is that he/she was subscribed to ruby-talk at that time.

I find his answer to his own questions about proc/lambda/blocks unsatisfying since that would be IMHO a good question to identify people who know ruby well.

</comment></comment></comment></comment></comment><comment><USER7> I wouldn't design an interview just for a specific programming language. If they can prove to me that they understand OOP and functional programming concepts up to my standards, then they should be able to write useful code given a week or two to learn the language at hand. In the case of Ruby, this time line could potentially be shorter. The syntax is dead simple and the API is rather intuitive.

<comment><USER5> The fact that the syntax is simple doesn't mean it's easy. I could learn lisp syntax in two days but that doesn't make me ready to work in a lisp shop.

</comment></comment><comment><USER8> I don't see a strong correlation between these questions and being a great programmer.

Being a great programmer doesn't mean knowing the nomenclature.

It is - in part - knowing which structure and algorithm is appropriate to solve a problem, and how to implement it efficiently with the given language.

</comment><comment><USER9> _Variable typing is one of those topics that everyone sort of understands it, but is hard to put it into words. I've iterated and improved the next series of questions to really test a senior level candidate's knowledge of static and dynamic typing. This is my best attempt so far._

And a naive, inapt, incorrect, nomenclature-misusing attempt it is!

Please read and re-read the nearly perfect "What To Know Before Debating Type Systems" before broaching this topic in any forum: <http://www.pphsg.org/cdsmith/types.html>

</comment><comment><USER10> That gotapi.com link is sweet. Is it commonly known?

<comment><USER11> I think so. I've been using it in a fluid app for a long time now. <http://railsapi.com/> is good for Ruby, too, especially since it's customizable.</comment></comment>


Ask HN: What to write on landing page? - <AUTHOR>

I am developing a real estate site. The site is for business real estate and not the private sector.
The question is how important is it to state this on the landing page?
Let's ask it more general, how important is it to declare to the public on your landing page (home page) the niche of your site? (compare to the general subject of your site)
Maybe to leave it uncertain is also good? <comment><USER2> Uncertainty is not helpful. If you subscribe to the YC style of startup landing pages (look at almost all YC companies), it is exceedingly clear what the website does in one sentence.

Examples:

Airbnb - Find a place to stay.

Picplum - Share Your Best Moments

Carwoo - Great New Car Deals

Referly - Recommend products you love

Then after that headline, they go into more detail:

Airbnb - Rent from people in 26,893 cities and 192 countries.

Picplum - Send photo prints to loved ones in seconds.

Carwoo - None Of The Games

Referly - And earn rewards when people buy them

Notice that in all of them, they have a great sentence in 4-6 key words, then a tagline that details what it does specifically. Regarding your comment elsewhere on this page "The reason is that I want to attract 'others' to my site- for future use". This is a bad idea. Focus on one thing and do it extremely well. The future will take care of itself. If you aren't able to get the real estate site to work now by being focused, then the future site won't matter.

</comment><comment><USER3> You landing page should be as specific as possible in my experience as a user. If I visit a unknown site's landing page, I look for specifics right away to understand what the product does and for whom. In your case, you must mention business real estate. How you mention it is left to the creativity and imagination of yours.

<comment><AUTHOR> Can any of you know what padmapper.com is about through landing page? is it business? private? is it like taskrabbit? that's what i mean... can i do it as well?

<comment><USER2> You can know through the domain name. Then when it loads up, the tag line is "Making Apartment Hunting Suck Less" with google maps right behind it. To me that's pretty clear that it will tell me what apartments are available for rent in the region I specify.

</comment></comment></comment><comment><USER4> How could clearly explaining what your site does and who it's for _not_ be the right thing to do?

I can't even begin to think of a reason why you would hide this from potential users.

<comment><AUTHOR> It is not for hidden reasons. The reason is that i want to attract 'others' to my site- for future use.

<comment><USER5> If this was the case, wouldn't that give you the wrong impression to the interest level for your product?

I mean, how would differentiate the one that are seriously interested from the "others"?

</comment></comment></comment><comment><AUTHOR> OK all, I got your point and I guess I have no other choice but to use it. Thanks for the comments.</comment>


Wikipedia chooses Lua as its new template/macro language  - <AUTHOR> http://en.wikipedia.org/wiki/Wikipedia:Wikipedia_Signpost/2012-01-30/Technology_report

<comment><USER2> _... it was only this week [on wikitech-l] that a consensus seemed to emerge in favour of Lua, a lightweight but relatively unheard-of language generally regarded as being "easy to learn" ..._

I find it fascinating how people who need an unusual solution keep coming to this one.</comment>


Comparing Triton containers to VMs and bare metal servers - <AUTHOR> https://www.joyent.com/blog/understanding-triton-containers <comment><USER2> [https://www.youtube.com/watch?v=Ll50EFquwSo](https://www.youtube.com/watch?v=Ll50EFquwSo) Building and scaling container driven cloud infrastructure - Bryan Cantrill (Video about Triton)

</comment><comment><USER3> I've been watching Joyent with interest for a while now, but I don't think I or my employer will be using their public cloud any time soon. Frankly, the pricing standard set by DigitalOcean a couple of years ago, and since followed by Linode (my and my employer's current favorite) and Vultr, is pretty hard to beat. I don't know how I'd justify 2x the price (not even counting bandwidth) when the performance of Linode is good enough. So I'll just continue to watch with interest. Now that SmartDataCenter is open source, maybe someone else will set up an SDC cloud with pricing that's competitive with DigitalOcean and the like. That would suck for Joyent though, so I shouldn't really wish for it.

</comment><comment><USER4> there are about 60 mentions of the word "container" on that page, including a full chart of questions "Compared to Docker in a VM", such as "Where are containers run"?

But the real question that should be at the top of the file, or at least that table of questions, is "what is a container"?

So: what is a container? (As opposed to a VM.)

<comment><USER5> Container is a chroot jail on steroids. VM is a QEMU process (also in a container).

<comment><USER4> how can you run a totally different architecture from just a chroot jail? It doesn't make sense. How are you "on the metal" if you're running some totally different kernel from what the chroot-jail-host is running? You can't both be running the kernel on the metal...

<comment><USER6> It's not a different architecture. SmartOS is x86 based, as are the Linux binaries.

What lx-brand zones do is present an alternate system call table to the binaries executed inside the zone. Those "lx" calls are compatible with the Linux system call table and get mapped and/or translated to illumos kernel system calls. Binaries don't know the difference.

<comment><USER7> So Triton is basically (simplifying) Solaris / SmartOS zones with the LX stuff installed?

<comment><USER6> It's that, plus cloud orchestration (i.e., SmartDataCenter) which includes sdc-docker, providing the Docker API and image management.

</comment></comment></comment></comment></comment></comment><comment><USER8> _Containers hosting hardware virtual machines running Windows, FreeBSD, or others_

Can't we just describe VMs as VMs and be done with it? So it's a container that has a VM inside it?

<comment><USER9> Yes, the QEMU process that underpins the hardware virtual machine lives within a container on the host. It means that a vulnerability in QEMU that allows for guest escape will land you in an otherwise empty container, rather than out on the host where other tenants are accessible.

But Triton is first and foremost about _container-based_ virtualisation: which involves no HVM at all!

<comment><USER8> Ah, that's something I hadn't considered. Good point. I guess the overhead will be minimum in that scenario.

</comment></comment></comment><comment><USER10> Surprising that Joyent used an extremely similar name as Amazon's extremely similar product, EC2 Container Service (EC2 expands to Elastic Compute Cloud, so the full name is Elastic Compute Cloud Container Service)

[http://aws.amazon.com/ecs/](http://aws.amazon.com/ecs/)

<comment><USER11> The name is very similar but the products are not so similar -- ECS simply schedules Docker containers across the virtual machines you already have running on AWS. Triton schedules and runs containers on bare metal. Virtualization of course has performance and I/O overhead.

</comment></comment><comment><USER12> Now if only they fully supported AMD CPUs...

<comment><USER6> SmartOS runs just fine on AMD CPUs. KVM support for AMD hasn't been merged to illumos-kvm yet (mostly just due to time), but you can do your own builds with it ([https://github.com/jclulow/illumos- kvm/](https://github.com/jclulow/illumos-kvm/)).

But Triton containers don't run in KVM anyway. They run natively on the OS with no VM. So you can download and run Triton on AMD today, just as you can with Intel CPUs.</comment></comment>


Ask HN: What are some good platforms for an online publication? - <AUTHOR> I'm looking to start an online publication and am not sure what platform to use. Any suggestions? <comment><USER2> arXiv.org is the standard for scientific publications</comment>


One Way to Not Piss Off Interview Candidates - <AUTHOR> https://hackernoon.com/beyond-the-recruiting-funnel-the-candidate-climb-d9eb79ffcf0a <comment><USER2> After going through all the steps with a big corp, I was "offered" to do an additional interview if I wanted to be assessed at my current level (they leveled me lower). I stood my ground and respectfully declined, and eventually they made me an offer for the correct level. What I learned the hard way was that you need at least one more competing offer, otherwise you won't have any leverage.

<comment><USER3> Well duh, your salary is more tightly correlated to your leverage than the value you create.

</comment></comment><comment><USER4> Pro tip: don't stand up the candidate, as happened to my gf at Youtube on Friday. She showed up, signed in, but the recruiter never showed up.

<comment><USER5> Resembles a date. Dating and interviewing has much in common. Judge a person in the time it takes to drink two beers to see if you want to stick together. It's all hunches and feeling and there is no need to over analyze it.

</comment></comment><comment><USER5> So much diagrams with made up data. It's like ... it's OK to make up things just because it not falsifiable. Who could have thought?

"Onsite interview (high effort): The candidate goes onsite for a day of interviews at the company."

You don't have to interview for a day, silly.

"Often, resumes are screened in a few minutes (or seconds!)"

Jesus, throw a dice instead.

How about this process.

* Post ad.

* Pick 4 candidates and bring to your office. (Throw a dice to filter resumes out if they are too many).

* Interview them for 1h and give a offer to the best candidate. If he declines, give offer to 2nd best and so on.

<comment><USER6> > So much diagrams with made up data. It's like ... it's OK to make up things > just because it not falsifiable. Who could have thought?

That's a bit of a strange criticism. The diagrams are meant to be illustrate a point, not precisely quantify data.

<comment><USER5> OK true it is a bit of nitpicking.

</comment></comment></comment><comment><USER7> > One way

That's actually four ways. But they're all good.</comment>


Ask HN: How far along is the development of AI for reading medical scans? - <AUTHOR> I've read some sources saying that there isn't enough labelled data available to properly train an algorithm, and some saying that there are already viable solutions being tested at hospitals. What are existing AI solutions capable of doing so far in this field, and how long would it take for them to be commercially used by hospitals / healthcare providers? <comment><USER2> About 7-10 years ago I tech-MBA-style consulted with a half dozen medical scan reading via machine learning startups in Southern California. In each case, I noticed the CEOs being overwhelmed by their investors, loosing control as soon as their potential was validated, and sold to giant healthcare corps, most often against the protests of the founders. In each of these situations, the startups were working with large offshore teams annotating medical scans for their ML training. I was usually hired to write a prospectus or similar investment document, so my exposure to each startup was brief. But in every case, the founding team kind of were knocked off their feet by the aggression of their investors. I checked back with two of the CEOs about two years ago, and both of their startups were shutdown after acquisition.

</comment><comment><USER3> Oh the fun. Yes, there are some solutions being tested for specific types of scans and specific diagnosis, but not nearly enough is operational yet.

My "short" answer: There are a number of people/companies researching AI for medical scans/records, but it is true that finding enough properly documented and labeled scans/images/records etc is hard. Privacy laws also add a fairly high burden which makes the research hard, the privacy laws/rules are needed but sometimes they are more about adding road blocks than actually protecting anyone's privacy.

Another part to getting good training sources is in more complex scenarios there isn't always one answer for a given scan, or it is possible multiple issues can be found. So it is hard sometimes to isolate the specific issue in some scans which adds complexity. Add to this that if you have 4 medically trained people read the scan independently and without influence you will generally get different answers to all but the simplest diagnosis.

There are places in medicine that are easier and where more consistency is available and that is where the current set of most algorithms and work is being done. Some things are also easier to box into categories than others, so again that makes them lower hanging fruit which is what I see happening right now. All that said, to bring product to commercial market is the largest gap IMO, lots of companies/people have researched and built tools/algorithms/models but few have cleared the FDA in the U.S. I'd say the biggest hurdle right now is bringing products to commercialization and understanding how to do so.

As for most current AI: Most of what is commercially available is not predictive and instead is used as aids in finding missed data points that might change the diagnosis or highlight something specific for treatment. For example, there are some that highlight fractures that would otherwise be missed by a radiologist reading an x-ray. Same thing for CT/MRI scans where sometimes literally thousands of images are generated for a single scan and missing something is not unheard of. More work has been done around imagery analysis than on most other parts of the patient record IMO, so you'll find more data around that side than you would around vitals analysis or predictive diagnostics.

Honestly I could go on about this for a long time. This is an area ripe for innovation but has regulatory hurdles most startups fail to grasp and fail to navigate.

I am the CTO for a startup that is working on these types of problems (vitals & predictive specifically), we have one FDA cleared product and see many opportunities to make a positive impact on patient care.

<comment><AUTHOR> Thank you for the response! This seems to be a sector that could highly benefit from AI development, especially given the number of required medical scans is steadily increasing and the number of qualified radiologists is declining in most countries. Given you are in the sector, could you share the names of a few companies / startups that you think are making the most progress?</comment></comment>


Apple engineer describes what it was like to work on the original iPhone - <AUTHOR> https://bgr.com/2016/12/26/iphone-history-wiki-original-iphone-engineer-project-purple/ <comment><USER2> Existing discussion here: [https://news.ycombinator.com/item?id=13268447](https://news.ycombinator.com/item?id=13268447)</comment>


How Pencils Are Made (2016) - <AUTHOR> http://www.npr.org/sections/ed/2016/10/11/492999969/origin-of-pencil-lead <comment><USER2> Good article, if you don't read it, at least take this nugget away with you:

      "A single pencil can draw a line over 700 miles long."</comment>


INDUSTRIAL SOCIETY AND ITS FUTURE - <AUTHOR> http://www.washingtonpost.com/wp-srv/national/longterm/unabomber/manifesto.text.htm <comment><USER2> It was a pile of twaddle in 1995, and it still is.

<comment><AUTHOR> Yea, he lacks compassion for human life. He also has a crazy idea that we wipe out advanced technology and civilization to start over. But it's not all twaddle. He has a logical argument that large-scale organizational technological progress leads to an inevitable dystopian future, and I would actually like to hear more discussion on that topic.</comment></comment>


Ask HN: Why is HN based on tables? - <AUTHOR>

From my point of view, it's paradox that a website like HN is so outdated (HTML-tables, inline-styling, non-responsive) while hundreds of people post interesting state-of-the-art stuff here... Is it because of the KISS-concept? Or does nobody dare to update the source code? <comment><USER2> It's worthwhile to ask questions like this from time to time, and it's one of the values "new blood" brings to any community (asking the same questions but a year or so later since the last person). In this case, OP, you've "mixed metaphors" so to speak - your title is about tables, but then you mix in inline-styles and non-responsive which open the possibilities of the answers quite a bit. I think your question can be broken into two parts: (1) the design of HN, and (2) the tech parts.

1) Over the years, people have posted many suggested HN redesigns. Inevitably, they've made much more whitespace - making it more like {reddit | digg | etc} - and people always are polarizing in their comments ("Hate it - how can I function with this many scrolls?!?!" or "Love it - HN looks like crap currently!"). I suspect the "Love the current design" crowd is/has been in the majority or perhaps pg himself is in that group - either way, I've yet to see a redesign post that a large group of the community embraced. The end result: the majority of people seem like the way it is now so nothing has changed.

2) For the tech aspect, I have to ask whether you see "HTML-tables, inline- styling" as perhaps the reasons behind the "non-responsive"? Do you propose that moving to a CSS-based grid system with external stylesheets would make the system so much more responsive that we wouldn't have trouble? That's not necessarily the correlation you've drawn in the OP but it is possible that you think these are the reasons, I suppose (or contributing factors). pg/admins have talked about the server before (and it's recently been upgraded/replaced). They've also talked about the DDOS attacks they have been under as well (I think they are on Cloudflare now to help mitigate this). In the end, it's a single server managing a large community. Inevitably there will be problems when you mix those two.

</comment><comment><USER3> Perhaps the value of websites is unrelated to whatever cargo-culting nonsense constitutes good web design at the moment. HN is functional. You don't maintain it. Who cares if it uses tables?

<comment><USER4> There's always at least one person who responds in this kind of aggressive tone. I don't think the question is about good web design, but about good data structure, doing things in a maintainable way.

It's like "Why don't you comment your code?" "Perhaps the value of my code is unrelated to whatever [blah blah] nonsense constitutes good programming practice? My code is functional. You don't maintain it. Who care's if there are comments?"

<comment><USER5> How do you know it is unmaintainable? Have you seen the code?

<comment><USER4> I wasn't specifically saying the code itself wasn't maintainable. However, I wrote a scraper for HN and the structure isn't really there. Granted, no one designs a website to be scraped. It's the kind of "well, let's use a table for everything" that people use for their first web application because they don't know how to use CSS.

I'm not one to complain about it, I like HN and yes it does the job, but to get aggressive with someone when they point out a problem... Not really productive.

</comment></comment></comment></comment><comment><USER6> I think the question misunderstands the nature of the task.

The HN page is a list with each list entry having a similar structure being made up on a number of components (like an up vote facility). the HTML table seems to fit the requirement perfectly.

As to "in line" styles and JavaScript - this approach would seem to me to be very well suited to the task of generating the individual components that collectively construct the list of entries. A small snippet of code can be used to generate each component. Maintenance is a breeze - adjustments need only be made in one place in the code base.

So all in all, what we see is a simple solution to a straightforward task.

</comment><comment><USER7> This has been discussed before, and there's useful comments in the old threads, so it's worth searching to find them.

There are a bunch of HN redesign attempts. Some of them are reasonably nice. They all seem to have the same problems - less information is presented.

There are a whole slew of plugins, extensions, user scripts, user styles, alternative websites, etc etc, that add or change functionality for HN. (I'm making a list for a tiny website which I might put up one day. It's tricky curating everything.) So people can tweak HN to be pretty much how they like.

I'd really like bigger buttons, or more spacing on the up / down vote arrows, to prevent fat-finger-voting errors.

Once you start tweaking HN it's hard to know when to stop. Remove the tables; use semantic markup. But then should you add comment-tree-collapsing?

</comment><comment><USER8> HN HTML code is just… creepy. FONT element everywhere, tables, etc. I think my phone would love to save something and profit the responsiveness of the HTML5 and CSS work. And why not my 3G connection, or my laptop. Why should I waste resources when this can be done well.

</comment><comment><USER9> Why not use something like Stylebot (<http://bit.ly/13qEfhm>), then you can just apply your own style. This is what my HN looks like: <http://imgur.com/LDMWgMd>

<comment><USER10> I cannot express how much I adore Georgify Dark (Hacker News) userstyle [1]. And it is quite amusing to see how many other userstyles exist for this site [2].

BTW, There was "Show HN: HackerNews reimagined without tables or center elements." [3] with relevant discussion.

[1] <http://userstyles.org/styles/71155/georgify-dark-hacker-news> [2] [http://userstyles.org/styles/browse/ycombinator?as=1&per...](http://userstyles.org/styles/browse/ycombinator?as=1&per_page=50) [3] <https://news.ycombinator.com/item?id=4376184>

</comment></comment><comment><USER11> A good functional programmer should be able to update inline styling and replace it with an external style sheet, although there is still the issue of whether anyone who has authority to change the code base actually thinks that is worth the trouble.

<comment><AUTHOR> This leads us to the question why HN is written in Arc. The first version of reddit has been written in Lisp, but later on they realized that Python is much easier to maintain, because there are simply more Python-programmers than Lisp-geeks. HN in some way tries to emulate the early days of reddit, but now it's time to follow reddit's example and rewrite HN in a more common language.

<comment><USER12> >HN in some way tries to emulate the early days of reddit, but now it's time to follow reddit's example and rewrite HN in a more common language.

Why? HN isn't a startup needing to hire a bunch of people to hack on the codebase; it's a site written by Lisp experts -- _in their spare time_ \-- with, I believe, one programmer paid to hack on it. It's open-sourced in dumps, and they don't seem too interested in working with other people on it (I sent in a small patch to add quotation support to HN, and didn't hear back), as it seems to satisfy their needs.

What's the benefit of rewriting?</comment></comment></comment>


Animated Bézier Curves - <AUTHOR> http://jasondavies.com/animated-bezier/# <comment><USER2> There are many similar infographics (infogifs?) displaying Bézier curves, but this[0] is by far the best in depth explanation of what those colored lines actually mean or how you get them.

[http://sploid.gizmodo.com/fantastic-explanation-of-how- compu...](http://sploid.gizmodo.com/fantastic-explanation-of-how-computers- draw-curves-1641989231)

<comment><USER3> Please don't link to sites like gizmodo aggregators, here is the direct link: [http://vimeo.com/106757336](http://vimeo.com/106757336)

</comment></comment><comment><USER4> These things are great, I have always thought it would be a great resource to have a library of them that are creative commons.

There doesn't appear to be a name for what they are however. Concept- expressed-as-code-generated-animation that-is-sometimes-interactive is a bit longwinded. Ceacgatisi is a bit of a mouthful.

The idea that it should have a name is not as trivial as it might seem. If these things had a name it would stimulate development of new ones. "I'll make an X" "Let's see if there's an X for that concept".

The odd thing is it would probably be best if a name used for the idea didn't actually express what the idea was. An abstract name that allowed the idea to form naturally rather than directing a specific manner. Much in a similar way to Kodi is an abstract name rather than the descriptive (but inaccurate) XBMC.

<comment><USER5> Bret Victor calls these sorts of things "explorable explanations" [1]. Lately the term seems to be catching on with a few others [2] as well.

[1] [http://worrydream.com/ExplorableExplanations/](http://worrydream.com/ExplorableExplanations/)

[2] [http://blog.ncase.me/tag/explorable- explanations/](http://blog.ncase.me/tag/explorable-explanations/)

</comment></comment><comment> yavor-atanasov Here's a similar thing I did 5 years ago (yes, I know it is in actionscript :) ): [http://yavkata.co.uk/weblog/actionscript_3/bezier-curve- inte...](http://yavkata.co.uk/weblog/actionscript_3/bezier-curve-interactive- visualization-with-actionscript-3/)

</comment><comment><USER6> Very instructive!

I've often seen where Bézier curves ("splines") are used to interpolate 'missing' data (for visualization, but also for analytical curve fitting) and always worry that hidden assumptions are thereby in place, (for instance: is nature, by default, 'smooth'?). If there was a reference discussing this situation, I'd love to be directed to it.

</comment><comment><USER7> I made something similar on the Khan Academy a while back: [https://www.khanacademy.org/computer-programming/bezier- thin...](https://www.khanacademy.org/computer-programming/bezier- thing/5150292972142592)

<comment><USER8> It may be useful to explain that you have to click on the black area a few times to make this do anything.

</comment></comment><comment><USER9> The wikipedia page about bézier curves has a similar gif. This is actually how I first understood the concept and drew my first bézier curve (seeing the picture was enough to implement it), years ago. Great visualization, very easy to understand.

<comment><USER10> There is a link to that Wikipedia article/animation at the linked site:

[http://en.wikipedia.org/wiki/B%C3%A9zier_curve#Constructing_...](http://en.wikipedia.org/wiki/B%C3%A9zier_curve#Constructing_B.C3.A9zier_curves)

</comment></comment><comment><USER11> mystifying..

but make sure to pronounce it "beˈzje"

[http://en.wikipedia.org/wiki/Pierre_B%C3%A9zier](http://en.wikipedia.org/wiki/Pierre_B%C3%A9zier)

<comment><USER12> It sounds exactly like it's spelled in French.

<comment><USER11> hackeur news

</comment></comment></comment><comment><USER13> Nicely done. Illustrates the mechanisms great.

</comment><comment><USER14> This is something like the 4th or 5th time I've seen Bezier curves appear on HN. What do you IT guys even use them for? Vector graphics?

As a MechE, we encounter them mainly due to CAD and associated computational engineering, but I couldn't map how they'd be used in the more general IT world. I'd love to hear some use cases!

<comment><USER15> I use them for timing functions such as various easeings etc. But also for graphics, though here I tend to use cardinal/catmull-rom splines more.

Edit: I did make a JS implementation of the latter if anyone's interested (MIT): [https://github.com/epistemex/cardinal-spline- js](https://github.com/epistemex/cardinal-spline-js)

</comment></comment><comment><USER16> I wrote some Clojure code a while back that may or may not correctly implement interpolation over 2D Bezier curves here [https://gist.github.com/th0ma5w/4035151](https://gist.github.com/th0ma5w/4035151)

</comment><comment><USER17> Well, there is at least another source with better visualizations AND explanations of bezier curves. So I'm not impressed at all.

The ultimate guide for bezier curves including great animations to explain the concept is from pomax:

[http://pomax.github.io/bezierinfo/](http://pomax.github.io/bezierinfo/)

I would go as far as to call it a bezier reference document. I learned both geomteric and numerical approaches to calculate, combine and draw bezier curves from this source. I am still amazed by the beauty of de Casteljau's algorithm.

The document has been submitted here before:

[https://news.ycombinator.com/item?id=8804691](https://news.ycombinator.com/item?id=8804691)

[https://news.ycombinator.com/item?id=5714842](https://news.ycombinator.com/item?id=5714842)

[https://news.ycombinator.com/item?id=7997706](https://news.ycombinator.com/item?id=7997706)

</comment><comment><USER18> Here's mine from awhile ago: [http://techblog.appnexus.com/2011/an-animated- bezier-curve-d...](http://techblog.appnexus.com/2011/an-animated-bezier-curve- demo/)

</comment><comment><USER19> Didn't Lea Verou already do this? [http://cubic-bezier.com/](http://cubic- bezier.com/)

<comment><USER20> Almost completely different. Hers lets you design a bezier curve for practical use, but doesn't explain the concept.</comment></comment>


Your Social Security Number has been found in the decimal expansion of PI - <AUTHOR> https://twitter.com/foone/status/1160977131867758593 <comment><USER2> Cute. So would it be possible to find the ordinal position of any particular SS# in the expansion?</comment>


Number Worlds - <AUTHOR> http://www.numberworlds.com/ <comment><USER2> Whenever I look up a number, I see the same representation for Base 10 and Base 11 — see e.g. 1000:

[http://www.numberworlds.com/numbers/1000](http://www.numberworlds.com/numbers/1000)

In Base 11 that should be 82a.</comment>


Apple is allowing independent repair shops to officially service iPhones - <AUTHOR> https://9to5mac.com/2019/08/29/apple-independent-repair-provider-program/ <comment><USER2> I wonder if Louis Rossman is a part of this trial program? He certainly made a lot of noise about the right-to-repair.</comment>


Facebook says it owns "book", suing startups using [generic]book.tld - <AUTHOR> http://www.latimes.com/business/la-fi-0826-facebook-suit-20100825,0,2104101,print.story

<comment><USER2> Since "facebook" is already a generic term for "a reference book or electronic directory made up of individuals' photographs and names," I don't see how they can make much of a strong branding claim (though I will certainly agree that "Facebook" is a more popular usage than "facebook").

I'd be hard-pressed to think of this as anything except poor planning when choosing the name. This is not really a case of brand dilution like Xerox, Scotch Tape, or Band-Aids. Guess you should have thought of that earlier, Zuck?

<http://en.wiktionary.org/wiki/facebook>

<comment><AUTHOR> In fact, part of their success ironically is _because_ of the generic nature of their name.

<comment><USER3> How so?

</comment></comment></comment><comment><USER4> In all fairness it seems like they're trying to say that they own [generic]book.tld in the context of social networks. Teachbook.com sounds like it's a social network for Teachers and is possibly using its name to say "Hey, we're like the Facebook of teachers". It's be like if we decided that Hacker News needed a social network and decided to call it Hackerbook.com

Not sure I agree with Facebook's actions here, but they're hardly saying what the headline claims.

<comment><USER5> If GodTube.com, a religion-centric video site can exist, then so can TeachBook. I don't see how any company can own generic words when used as part of a phrase, even when the industry is the same. I can certainly create a company called MicroChime or YouChime or ChimeSoft.

<comment><USER6> > If GodTube.com, a religion-centric video site can exist, then so can > TeachBook.

Arguably, Youtube has lost its claim on "tube" by not defending its trademark:

[http://en.wikipedia.org/wiki/Genericized_trademark#Avoiding_...](http://en.wikipedia.org/wiki/Genericized_trademark#Avoiding_genericide)

If Youtube had sent cease and desist letters to Godtube and other "-tubes", and escalated to court if the person hadn't ceased and desisted, it probably would have worked. (This doesn't get into the morality or cool/uncoolness or business strategy or PR aspects of it, it's just trademark law)

> I don't see how any company can own generic words when used as part of a > phrase, even when the industry is the same.

Actually, that's exactly what a trademark is. Owning generic words and phrasings in the same industry.

> I can certainly create a company called MicroChime or YouChime or ChimeSoft.

Debatable. MicroChime would probably be okay if you sold small chimes. If you sold operating systems and business software, you'd absolutely get a cease and desist, and you'd almost certainly lose if it went to court. Again, this doesn't get into the morality of it, just how trademarks generally work these days.

</comment></comment></comment><comment><USER7> This was discussed at some length yesterday:

<http://news.ycombinator.com/item?id=1633106>

Long story short: PerfumeBay lost a case for diluting eBay's trademark; Victor's Little Secret lost a case to Victoria's Secret; Charbucks appears to be on its way to losing to Starbucks. Famous marks can (and may be obligated to) defend themselves against dilution from similar (but not identical) marks.

</comment><comment><USER8> How can I possibly distinguish between Coca- _Cola_ and Pepsi- _Cola_?

If only PepsiCo had been sued out of existence about 50 years ago for "trademark" infringment, we would never had this problem.

<comment><USER9> By the time Pepsi came along, "Cola" was already a generic term. The guy who invented "Cola" drinks failed to trademark the name (in connection to drinks, as opposed to plants).

He died in obscurity. Maybe if he'd sued Coke at its inception, he could have been as famous as Pemberton.

<comment><USER3> Really? I thought it was called Cola because of Kola.

<http://en.wikipedia.org/wiki/Kola_nut>

</comment></comment></comment><comment><USER10> In retrospect Microsoft could sue any company with soft in their name; God knows how many software companies use the suffix Soft. What Facebook is doing is simply not positive.

<comment><USER11> No, they can't because, as you say, there are now many companies using that suffix. If they had gone after companies earlier (as facebook appears to be doing) they might have a case.

</comment></comment><comment><USER12> That sounds ridiculous. They have the facebook trademark protection, and that's pretty much what they can enforce. And even that's sometimes not enough to enforce a wide range exclusivity. For instance, titles of books can contain the word facebook, and can only be prevent a publisher from using the facebook logo on the cover, but screenshots on the inside pages containing it should be publishable. Afaik all the evicted antisemitic groups could form a social network called hatebook, and they wouldn't be infringing if they used a different typeface and overall identity. IANAL, but trademark law is pretty straightforward. This reminds me of <http://www.eolas.com/>, got to love how they troll about their (e) trademark and all the software patents.

</comment><comment><USER13> Looking at my list of domains there are:

      * 118152 com domains ending in "book"
      * 14450 net domains ending in "book"
      * 8666 org domains ending in "book"

which is going to require a lot of litigation.

Even narrowing it down to domains ending in "book" with "face" somewhere in the domain, there are:

      * 6175 com domains
      * 691 net domains
      * 389 org comains

Where to draw the line?

</comment><comment><USER3> The real problem is their offsite "Like" button and other offsite widgets.

It is too easy to have these on a site, and users will think it is sanctioned/blessed by Facebook.

This effect is much more significant when the domain name ends in book.[tld].

This is a double-edged sword brought on by their success and operation.

</comment><comment><USER14> Well its sort of good to know. I was planning on using book in one of my new domain names... Ugh. Now I have to find a new name??

</comment><comment><USER15> It'll be fun to see them go after the CIA World Factbook.

<comment><USER16> Not going to happen unless they decide to make it into a social network.

</comment></comment><comment><USER17> I just registered Phasebook, bring in the lawyers!</comment>


Loopt Eagerly Joins the iPhone Gold Rush - <AUTHOR> http://bits.blogs.nytimes.com/2008/07/11/loopt-eagerly-joins-the-iphone-gold-rush/index.html?hp

<comment><USER2> I don't think this article was particularly useful -- a snapshot of their business model, and a few SA quotes confirming that the iPhone was fairly important to the company (this should go without saying for a mobile social networking startup).

Personally, I don't/won't use Loopt, but I think the discoverability of others around you is probably the most interesting feature.

</comment><comment><USER3> good for them, but I have yet to know anybody that uses them. And most of my friends are the early adopter types.

I think Loopt has some really great PR, as we have been hearing so much about then, yet I don't know anybody that uses them. I think they are going against a human trend, that people most of the time, don't want their friends to know where they at.

Now, that Yelp app might actually be useful.

<comment><USER4> I think it's more likely that they haven't been on handsets that their target audience owns. They just added iPhone and Blackberry, and I can't name one of my friends who has a location-enabled smartphone that's neither a Blackberry nor an iPhone. For a while they were just on Boost, and don't know anyone who uses them as a carrier either.

In any case I look forward to trying out the service with all of my friends who now can actually use it. Big congrats to the Loopt team, especially Sam and Alok who I know from school.

</comment></comment><comment><USER5> I'd say Loopt is pretty useful, though as with all social networks the usefulness increases with the number of people you know on the network (<http://en.wikipedia.org/wiki/Metcalfe's_law>) and I don't know many people on Loopt.

I look forward to the day when rather than messaging/calling a dozen friends to see who's around I can just look on Loopt and see if a friend is nearby who I want to hang out with.

Actually, I just installed Loopt yesterday, and this morning I was wondering where one of my co-founders was. I checked on Loopt, and there he was, "39 mi NW" in SF. I didn't even have to bother him to find out what he was up to. It's kind of like Twitter, but implicit instead of explicit. I don't have to manually update it to let people know where I am.

<comment><USER6> If only you didn't have to manually update it on iPhone. You still have to launch the app.

</comment></comment><comment><USER7> I can't imagine using loopt. Anyone here a fan? I don't want anyone to be able to snoop in on my location let alone broadcast it. And then have a firm sell ads against it.

But maybe I just need to start wearing another polo and I'll be in the target demo:

<http://www.flickr.com/photos/grahamb/2565911988/>

<comment><USER5> Lay off Sam! I think he's gotten enough flack for the double polo incident... <http://www.youtube.com/watch?v=7dju9y5BdVQ> (though that video _is_ quite amusing)</comment></comment>


Dynamic JVM Language Complexity - <AUTHOR> http://gtrak.wordpress.com/2012/01/14/dynamic-jvm-language-complexity/

<comment><USER2> I mean, use the tool that's best suited for the job. I enjoy exploring Java, the JVM, functional programming and lisp syntax with Clojure. As a matter of fact, I'm working on a project right now in Clojure and having a great time. I use Python at work, and sometimes in hobby projects (though that's being muscled out by Clojure lately).

I agree that there is generally a lot less magic in lisps than Python. There's no magic in Python when you get down to it either, though. And for me, at least, my exposure to Python has helped me to spin up faster with Clojure than I would have otherwise. And my work with Clojure has changed the way I approach solving problems in Python.

Your post concludes with some lukewarm language zealotry. The last two sentences in particular are glaringly false dichotomies. Using Python doesn't mean you don't know how it works. Using Clojure doesn't mean you do know how it works. They're both just tools; abstractions you can leverage to make machines do what you want. You're criticizing the propensity of _some_ people to not learn how the stuff in their toolbox works, which has absolutely nothing to do with the language at hand.

It doesn't matter what tool we want to talk about, odds are there's someone out there using it with their head planted firmly up their butt. Usually it's me, but I take a day off every now and then.

<comment><USER3> I tried to take care to avoid zealotry, and I qualified my observations with my background experience. I'm not saying that You don't understand python, I just found it hard :-). My experience is not meant to be a universal, just one data point.

</comment></comment><comment><USER4> I'm not surprised, but it hardly seems like a fair comparison to look at a language with deliberately simple base concepts tailored for the jvm to a couple of languages attempting to implement a set of concepts which are not always a natural fit to the jvm.

Just trying to marry two languages subtly different inheritance models can be tricky, and it's those areas that Clojure so neatly avoids.

The bootstrapping point is interesting, I would like more of the language I work on to be implemented in itself rather than Java, but since the bulk of the runtime implementation is method lookup and other invokeDynamic stuff it would all start to get a little recursive, and I would want to take a very careful look at performance.</comment>


IBM Says Macs Are Up to $543 Less Expensive Than PCs Over Time - <AUTHOR> http://www.macrumors.com/2016/10/20/ibm-macs-less-expensive-than-pcs/ <comment><USER2> But what's the net? Macs are also more expensive so is it a wash? Also, Macs (to me) appear to be on a much shorter support/life cycle so you'd have to factor that into the equation for a fair comparison.

<comment><USER3> Downtime are way expensive, especially Lenovo I seen too many hardware defective in MNC, this are hidden costs that add up to any organization and Lenovo have no replacement parts to replace for the next few weeks due to shortage _surprise_.

SCCM servers have downtime a few times that caused delay or postpone for Windows deployment.

</comment></comment><comment><USER4> Damnit! should've requested a Mac when they first announced this initiative</comment>


Police Find Paris Attackers Used Unencrypted SMS - <AUTHOR> https://www.techdirt.com/articles/20151118/08474732854/after-endless-demonization-encryption-police-find-paris-attackers-coordinated-via-unencrypted-sms.shtml <comment><USER2> Here in Australia, the government is already tracking when, where, and who you send SMS to. This will be a great justification for them to track content as well.</comment>


The Phone Stacking Game: Let's Make This A Thing - <AUTHOR> http://techcrunch.com/2012/02/04/the-phone-stacking-game-lets-make-this-a-thing/ <comment><USER2> People will be too stubborn to play this game. Or maybe my friends need to get off Facebook every now and then.</comment>